Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Breaking Honeypots For Fun And Profit
Newest First  |  Oldest First  |  Threaded View
AlirezaM983
AlirezaM983,
User Rank: Apprentice
9/15/2015 | 11:44:42 PM
Full presentation file
Hello

Do you have this presentation file?

thanls
felixonline
felixonline,
User Rank: Strategist
8/5/2015 | 4:18:19 AM
Not a fan either, but..
Don't disagree with the article and comments from folks. However, I think it is less about the concept and more about its positioning, use-cases and robustness/quality of implementation. Honeypots and their predecessors have been around for a while and have helped improve our knowledge of threats and attacks, methodologies etc. However, relying on these for cyber defence would be getting the balance wrong. I am aware of some innovative use-cases that use honeypots to test the quality of security defences in that provide a vantage point to the attacker but have other layers prevent or resist further proliferation and penetration. Clearly, excellent academic and research value. To summarise, this could be one of the layers however like the others I agree we should invest our time and energy in understanding the real-world problem rather than chase honeypot data !!
GadiE551
GadiE551,
User Rank: Author
8/3/2015 | 7:27:30 PM
Re: Not a fan
That's exactly the point, assuming compromise as we learned to do the past few years we KNOW the attackers are already inside. We don't need to lure them in. What we need is a way to detect them fast with low false positives, and get all the forensics data while we do it. Deception does that.
RyanSepe
RyanSepe,
User Rank: Ninja
8/3/2015 | 2:35:25 PM
Not a fan
For these reasons I am not a believer in leveraging honeypots/nets. Why poke the bear and piss him off? Rather lets build perimeters so the bear can't get in and catch us sleeping instead of luring it into the secondary perimeter with honey and hoping to God that he doesn't get out.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-2289
PUBLISHED: 2022-07-03
Use After Free in GitHub repository vim/vim prior to 9.0.
CVE-2022-2288
PUBLISHED: 2022-07-03
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.
CVE-2022-2290
PUBLISHED: 2022-07-03
Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta.
CVE-2022-2287
PUBLISHED: 2022-07-02
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
CVE-2022-34911
PUBLISHED: 2022-07-02
An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the usern...